831240 matches found
GHSA-RJ39-CV6W-8WV7 kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
Summary kin-openapi guards against NaN and Inf values in its built-in schema visitor visitJSON by returning ErrSchemaInputNaN / ErrSchemaInputInf when a float64 input violates those constraints. For OAS 3.1 specs, however, Schema.VisitJSON routes through useJSONSchema2020, which hands the value...
kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
Summary kin-openapi guards against NaN and Inf values in its built-in schema visitor visitJSON by returning ErrSchemaInputNaN / ErrSchemaInputInf when a float64 input violates those constraints. For OAS 3.1 specs, however, Schema.VisitJSON routes through useJSONSchema2020, which hands the value...
EUVD-2026-101424
Talos Linux: Support bundle does not redact registry credentials...
GHSA-7CXH-94CF-MFP6 Talos Linux: Support bundle does not redact registry credentials
Summary When generating a support bundle with talosctl support the credentials entered for private registries are included in the bundle. Details Within the generated support bundle, inside resources/registryconfigs.cri.talos.dev.yaml the auth field of the spec is retained. The same, potentially...
Talos Linux: Support bundle does not redact registry credentials
Summary When generating a support bundle with talosctl support the credentials entered for private registries are included in the bundle. Details Within the generated support bundle, inside resources/registryconfigs.cri.talos.dev.yaml the auth field of the spec is retained. The same, potentially...
EUVD-2026-101431
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication...
GHSA-637C-6JXX-4RWM KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
Summary A namespace admin who creates a TriggerAuthentication and a ScaledObject in their own namespace can make the KEDA operator send its own ServiceAccount token to a tenant-controlled URL. That token holds ""/"" get cluster-wide, so it reads every Secret in every namespace, plus batch/jobs an...
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
Summary A namespace admin who creates a TriggerAuthentication and a ScaledObject in their own namespace can make the KEDA operator send its own ServiceAccount token to a tenant-controlled URL. That token holds ""/"" get cluster-wide, so it reads every Secret in every namespace, plus batch/jobs an...
EUVD-2026-98917
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks...
GHSA-FMXQ-CGP8-87WP Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Impact Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks...
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Impact Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks...
GHSA-23VG-4CJM-66Q5 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
Summary openapi3filter.ValidationHandler.Middleware validates requests with kin-openapi's legacy router, which selects an OpenAPI operation from the decoded URL.Path. The method is documented as implementing gorilla/mux.MiddlewareFunc, but a downstream gorilla/mux router configured with...
kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
Summary openapi3filter.ValidationHandler.Middleware validates requests with kin-openapi's legacy router, which selects an OpenAPI operation from the decoded URL.Path. The method is documented as implementing gorilla/mux.MiddlewareFunc, but a downstream gorilla/mux router configured with...
EUVD-2026-101529
Appium: Symlink based Zip Slip in @appium/support ZIP extraction...
GHSA-QFXX-C367-67F8 Appium: Symlink based Zip Slip in @appium/support ZIP extraction
Summary CVE-2026-30973 GHSA-rfx7-4xw3-gh4m was a plain path traversal in the entry name. The containment check built an Error object without throwing it, so an entry literally named something like ../evil.txt was written outside the destination. That issue was fixed in @appium/support 7.0.6 by...
Appium: Symlink based Zip Slip in @appium/support ZIP extraction
Summary CVE-2026-30973 GHSA-rfx7-4xw3-gh4m was a plain path traversal in the entry name. The containment check built an Error object without throwing it, so an entry literally named something like ../evil.txt was written outside the destination. That issue was fixed in @appium/support 7.0.6 by...
GHSA-CR65-55V9-XHVV Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
Summary diohttp2adapter follows HTTP Location redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin 302 redirect receives the victim's Authorization, Cookie, and Proxy-Authorizatio...
EUVD-2026-98921
Dio: Cross-origin redirect leaks sensitive request headers in diohttp2adapter...
Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
Summary diohttp2adapter follows HTTP Location redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin 302 redirect receives the victim's Authorization, Cookie, and Proxy-Authorizatio...
GHSA-H4R5-MXV5-8MJC kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
Summary openapi3filter decodes deepObject-style query parameters by looping over every key in the request's query string. Inside that loop it recompiles a loop-invariant regular expression on every iteration. The pattern depends only on the spec-defined parameter name, not on the loop variable, s...